Design of RCM HA Switchover on Mass UP Failure